One HTTP request with no login may run code as SYSTEM on Thales Sentinel Keys Server, the CVE record says

Seven of eight severity metrics at their worst, and a stated result of SYSTEM

The CVE record for CVE-2026-78403, published by Thales as the numbering authority at 19:12 UTC on 30 October 2026, scores Sentinel Keys Server on Windows at CVSS 3.1 9.8. Seven of the vector's eight base metrics sit at their most severe value: reachable over the network, low complexity, no privileges, no user interaction, and high impact on confidentiality, integrity and availability (derived from the vector string). The eighth, scope, is unchanged, which is why the score is 9.8 and not 10. The record's CVSS 4.0 vector gives 9.3, with 8 of 11 base metrics at their worst and the three metrics for other systems set to None (derived).

In plain words, the record says Sentinel Keys Server "does not check the length of the first field in the HTTP request", that an attacker "may craft an HTTP request and send it", and that "it may lead to remote code execution as NT AUTHORITY\SYSTEM", the highest rights a Windows service can hold. The versions affected are those "lower than 1.3.8.0". The two weaknesses listed are CWE-121, a stack based buffer overflow, and CWE-862, missing authorization.

What that does not establish: that anyone has used it, how many servers can be reached, or which network port carries the vulnerable HTTP listener. CISA's enrichment of the record, about 47 minutes after publication (derived), says exploitation "none", which is a statement about what was known at 19:59 UTC on 30 October, not a guarantee. The record names no port. And the one Thales page that would explain the fix, support article KB0031216, is a secured article: the support portal answered that it needs a login, and this site did not read it.

Sources were read from 14:26 to 14:40 GMT on Sunday 1 November 2026: the CVE record, the NVD and GitHub entries, the CISA Known Exploited Vulnerabilities feed, Thales's public security updates page and two Thales download articles, the IANA port registry, and an older SafeNet ReadMe for the installer that carries Sentinel Keys Server. Where a fact rests on something other than the CVE record, the text says so.

What Sentinel Keys Server is, and why its owner may not know it is there

Sentinel hardware keys are the small USB dongles that software vendors ship with their products so that the software runs only where a licence key is present. Thales's own download article for Sentinel Protection Installer 7.7.1 describes Sentinel Keys Server as the component "for network applications protected with Sentinel Hardware Keys": in practice, the service that lets machines on a network use a key plugged into one host (the 2006 ReadMe below says the server "must be running on the system where the key is attached"). The same installer carries Sentinel Protection Server, for Sentinel SuperPro and UltraPro keys, and the Sentinel System Driver.

That installer is how the server usually arrives. Thales lists Sentinel Protection Installer among its "most requested drivers" on its Drivers and Downloads page. A SafeNet ReadMe for an older version of the installer, dated December 2006 and read from a copy hosted by a third party, says "ISVs and developers who wish to integrate these components in their Windows Installer-based setups" should consult the installer's help. In other words, the vendors who sell protected software can fold these components into their own setup programs. An engineering, design or laboratory application that uses a Sentinel key for network licensing can therefore leave Sentinel Keys Server running on a Windows host without the word Thales appearing anywhere the owner would look. That last step is this site's inference from the vendor's own wording, not a statement by Thales.

The detail that matters most: the Thales download articles for Sentinel Protection Installer 7.7.1 (KB0019063, last updated 28 February 2025, and the full package, KB0023089) were the newest public installer pages this site could find. KB0019063 says the package contains "Sentinel Keys Server 1.3.7.0". That is below 1.3.8.0, so the bundle Thales's public article still describes carries a version inside the record's affected range (derived). Thales may well offer a newer bundle behind its support portal login; this site could not see one, and the advisory that would say so is the secured KB0031216.

Thales's public Security Updates page, KB0027106, which the portal marks as updated on 30 October 2026, lists earlier Sentinel LDK bulletins and several third party issues under investigation. It did not mention Sentinel Keys Server or CVE-2026-78403 when read on 1 November. A customer who watches that page and nothing else would not have seen this one.

The mechanism, in the record's words

The record describes one request and one missing check. Sentinel Keys Server accepts HTTP requests. When it reads the first field of a request, it does not check how long that field is before copying it into a fixed size buffer on the stack. A field longer than the buffer runs past it and overwrites whatever the stack holds next, which, in the general case of CWE-121, can include the data that decides where the program goes when the current function returns. Thales's record says only that this "may lead to remote code execution as NT AUTHORITY\SYSTEM".

The second weakness, CWE-862 missing authorization, is why no login is needed: the request reaches the vulnerable code before anything checks who sent it. Both CVSS vectors encode that as PR:N, no privileges required, and UI:N, no user action. The attack pattern listed is CAPEC-100, Overflow Buffers. The record does not describe the request, the buffer size or the fixed check, and this briefing does not either.

Zoom

The record's clock, and a KEV check that predates the CVE

The record carries its own timestamps, and so do the entries that copied it. Laid side by side they show how fast the record travelled and one trap in reading a negative.

The last row is the trap. The KEV catalogue current at 14:29 GMT on 1 November was released at 17:02 UTC on 30 October, two hours and ten minutes before the CVE record existed (derived). "Not in KEV" therefore says nothing yet about this vulnerability: no catalogue has been published since the record was. It should be read again after the next release.

Who is in range

The record is narrow on purpose. It lists one product, Sentinel Keys Server, on one platform, Windows, below one version, 1.3.8.0, with every other case marked unaffected by default. Inside that range, the precondition the vector sets is network reach to the server, and nothing more.

Zoom

On ports, the record is silent, and what exists elsewhere is older or indirect. The IANA service name registry lists "sntlkeyssrvr", described as "Sentinel Keys Server", on port 9450 over TCP and UDP, registered on 21 August 2008. The 2006 SafeNet ReadMe says the default client communication port is 7001 and the default HTTP port of the Sentinel Keys License Monitor, a web page the server provides, is 7002. Neither source says which listener the vulnerable HTTP parsing sits behind, a twenty year old default may have changed, and an installer from another vendor may set its own. The only reliable answer is the list of ports the service is listening on, read on the host itself.

The record does not say whether Sentinel Protection Server or the Sentinel System Driver, the other parts of the same installer, share the flaw. It names neither, so their status is not stated rather than cleared.

Three comforting labels that are not controls

"Upgrade to latest version." That is the record's entire remedy. It is a fine instruction where the latest version is 1.3.8.0 or later. But the latest public Thales installer article this site could find lists Keys Server 1.3.7.0, and a protected application's own installer may carry whatever version its vendor packaged years ago. "Latest" is a label; the version number on the host is the control.

"It is only the licence server." Licence services are the kind of software that is installed once, works, and is never looked at again. This one accepts requests from the network so that other machines can use a licence, did not ask who was asking, and, per the record, can end with code running as SYSTEM. Its job is clerical; its privileges are not.

"Exploitation: none." CISA's assessment is dated 30 October and says what was known then. It is not a forecast. CISA also marked the flaw automatable, and the record says the attack needs no login and no user action. GitHub's unreviewed advisory shows an EPSS probability of 0.577 per cent at the 47.6th percentile, but the API does not say on which day that score was computed, so it is not used here as evidence of anything.

Stated, and not stated

What to do, in order

Technical details

Every block below is copied from a saved copy of the source named in its caption, read on 1 November 2026. The record's finder credit is omitted because it names a private individual; the IANA registrant columns are omitted for the same reason. No primary published a request, a payload, a detection rule or an indicator, so none is shown.

The vulnerability description as the CVE record prints it, with its line breaks. This is the whole technical statement Thales has made in public. Note the two uses of "may".

Stack-based buffer overflow and missing
authorization vulnerability in Thales Sentinel Keys Server on Windows allows
Overflow Buffers. Sentinel Keys Server does not check the length of the first
field in the HTTP request. An attacker may craft an HTTP request and send it to
Sentinel Keys Server. It may lead to remote code execution as NT
AUTHORITY\SYSTEM.





This issue affects Sentinel Keys Server:
versions lower than 1.3.8.0.

The two severity vectors, as the record prints them. A defender can use them to explain the score: every metric about who can attack is at its easiest, and every impact metric for the vulnerable system is High.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8, CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
baseScore: 9.3, CRITICAL

The weakness, the attack pattern and the remedy, as listed. CWE-862 appears in the CVE record and NVD; GitHub's unreviewed advisory lists CWE-121 only.

CWE-121 Stack-based buffer overflow
CWE-862 Missing Authorization
CAPEC-100 Overflow Buffers

solution: Upgrade to latest version.

The affected range as the record encodes it, and its CPE form. Asset tools that match on CPE will look for this string; a scanner that does not read the platform field may also flag hosts that are not Windows.

{
  "vendor": "Thalesgroup",
  "product": "Sentinel Keys Server",
  "platforms": [
    "Windows"
  ],
  "versions": [
    {
      "status": "affected",
      "version": "0",
      "lessThan": "1.3.8.0",
      "versionType": "custom"
    }
  ],
  "defaultStatus": "unaffected"
}

criteria: cpe:2.3:a:thalesgroup:sentinel_keys_server:*:*:windows:*:*:*:*:*
versionStartIncluding: 0
versionEndExcluding: 1.3.8.0

CISA's SSVC decision points, added to the record by CISA ADP Vulnrichment. The timestamp is the date the judgement applies to.

timestamp: 2026-10-30T19:59:29.771309Z
Exploitation: none
Automatable: yes
Technical Impact: total
role: CISA Coordinator
version: 2.0.3

assignerShortName: THA-PSIRT
dateReserved: 2026-08-24T14:22:05.425Z
datePublished: 2026-10-30T19:12:56.080Z
dateUpdated: 2026-10-30T20:02:33.210Z

This site's check of the KEV feed. The fields are copied from the feed; the last line is the result of searching it.

catalogVersion: 2026.10.30
dateReleased: 2026-10-30T17:02:45.3665Z
count: 1766
CVE-2026-78403 present: no

What the public Thales installer bundles. The version of Keys Server inside it is the one to look for on hosts that installed from this package.

This SPI 7.7.1 Package contains:
Sentinel System Driver 7.6.0
Sentinel Protection Server 7.7.1.0
Sentinel Keys Server 1.3.7.0

The older vendor ReadMe on integration and default ports. It is dated December 2006, describes installer version 7.3.2, and was read from a copy hosted by a third party, so treat the ports as historical defaults to check, not current fact.

Note: ISVs and developers who wish to integrate these components in their Windows Installer-based 
setups should refer to the Sentinel Protection Installer Help.

■ Modify the server and client port for communication. You may need to do this in case the 
default client application communication port (7001) is being used by some other 
application.
■ Modify the SKLM tool port. The default HTTP port is 7002.

The IANA service registration for the server's name. A registered port is a reservation, not proof of what a given install listens on.

sntlkeyssrvr,9450,tcp,Sentinel Keys Server  [registration date 2008-08-21]
sntlkeyssrvr,9450,udp,Sentinel Keys Server  [registration date 2008-08-21]

The question to put to every supplier

Thales has published a fixed version number and a one line remedy. Its public installer article lists the version before the fix, its advisory sits behind a login, and the products that install the server often carry another company's name. So the question for an IT manager is not whether Thales has fixed it. It is this: which of the programs on our Windows hosts installed Sentinel Keys Server, which version did each one ship, and can any machine that is not ours reach it?

Key facts